{"record":{"id":"cc8ad9a30976d3ca","repo":"quarkusio/quarkus","slug":"invalid-key-store-configuration-for-certificate-cc8ad9","errorCode":null,"errorMessage":"Invalid key store configuration for certificate '${name}' - cannot read the key store file '${path}'","messagePattern":"Invalid key store configuration for certificate '(.+?)' - cannot read the key store file '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":69,"sourceCode":"\n            KeyStoreOptions options = new KeyStoreOptions();\n            options.setType(config.type());\n            if (config.provider().isPresent()) {\n                options.setProvider(config.provider().get());\n            }\n            options.setValue(Buffer.buffer(data));\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String aliasPassword = CredentialProviders.getAliasPassword(config.aliasPassword(), ksc.credentialsProvider())\n                    .orElse(null);\n            options.setAliasPassword(aliasPassword);\n\n            verifyKeyStoreAlias(config, name, ks, aliasPassword);\n            return new KeyStoreAndKeyCertOptions(ks, options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path().get() + \"'\", e);\n        } catch (IllegalStateException | IllegalArgumentException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {\n        OtherTrustStoreConfig config = tsc.other().orElseThrow();\n\n        if (config.path().isEmpty()) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                    + \"' - no path specified and no TrustStoreFactory found for type '\" + config.type() + \"'\");\n        }\n\n        try {\n            byte[] data = read(config.path().get());","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L51-L87","documentation":"Thrown by OtherKeyStores.verifyOtherKeyStore when reading the configured key store file fails with an UncheckedIOException — the path exists in configuration but the bytes cannot be read (missing file, permission denied, truncated). The read failure is caught around the whole load block and rethrown as this IllegalStateException naming the certificate configuration and the offending path, with the IO cause attached.","triggerScenarios":"config.path().get() passed to read() throws UncheckedIOException — missing file, no read permission, bad filesystem mount.","commonSituations":"Path relative to working directory that differs in container/prod; secret not mounted; typo in path.","solutions":["Fix the path or make it absolute / resolve from classpath: quarkus.tls.key-store.other.path","Ensure the file is packaged or mounted in the deployment","Check file read permissions"],"exampleFix":"# before\nquarkus.tls.key-store.other.path=./ks.p12\n# after\nquarkus.tls.key-store.other.path=certs/ks.p12\n","handlingStrategy":"validation","validationCode":"if (!java.nio.file.Files.isReadable(java.nio.file.Path.of(path))) {\n    throw new IllegalStateException(\"Key store file not readable: \" + path);\n}\n","typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"cannot read the key store file\")) { log.error(\"File missing/unreadable: \" + path, e.getCause()); }\n    throw e;\n}","preventionTips":["Use classpath paths packaged in the artifact","Verify mounts in container images","Use absolute paths in prod"],"tags":["tls","keystore","io","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}